The Department of Justice and Constitutional Development (DoJ&CD) has been slapped with a hefty R5 million fine for non-compliance with an Enforcement Notice after violating the provisions of the Protection of Personal Information Act (POPIA).
The Information Regulator issued an Infringement Notice against the department on May 9, citing multiple POPIA violations. This action was prompted by a security breach suffered by the DoJ&CD in September 2021, which resulted in the unavailability of their IT systems and disruptions to public services.
Conducting an independent assessment following the data breach, the Regulator discovered that the department had failed to implement adequate technical measures to detect and monitor unauthorized data exfiltration. This failure led to the loss of around 1,204 files. The assessment also revealed that the department had neglected to renew crucial licenses, including the Security Incident and Event Monitoring (SIEM) license, which would have enabled the monitoring of network activities and the retention of log files.
In response to these findings, the Regulator issued an Enforcement Notice, requiring the department to provide proof within 31 days that the Trend Anti-Virus, SIEM, and Intrusion Detection System licenses had been renewed. However, the DoJ&CD failed to comply with the notice, and as a result, they have now been ordered to pay a fine of R5 million.
The Enforcement Notice also stipulated that the department should initiate disciplinary proceedings against the official(s) responsible for the license lapses, as these licenses are crucial for ensuring the department’s security against breaches.
The Regulator emphasized that failure to adhere to the Enforcement Notice within the specified timeframe would result in potential charges, with penalties of up to R10 million or imprisonment for the responsible officials upon conviction.
Despite the expiration of the 31-day compliance period on June 9, the department has not provided the Regulator with a report on the required actions or any communication on the matter. The DoJ&CD had the option to appeal the Enforcement Notice but failed to exercise that right.
Consequently, the Regulator determined that the department had not complied with the Enforcement Notice under the provisions of Popia and issued the administrative fine of R5 million for their failure to comply.
The DoJ&CD now has a 30-day period starting from July 3 to pay the administrative fine or make arrangements with the Regulator for installment payments. Alternatively, they can choose to face court proceedings on charges related to the alleged offense under the POPIAregulations.
How can this be prevented?
In today’s digital landscape, the looming threat of hackers can lead to significant headaches for organizations when it comes to compliance with the Protection of Personal Information Act (POPIA). Here’s how hackers can exacerbate POPIA-related challenges:
- Data Breaches: Hackers constantly seek vulnerabilities in an organization’s security infrastructure to gain unauthorized access to sensitive personal information. A successful data breach can expose personal data, resulting in severe POPIA violations and potential legal consequences.
- Unauthorized Access: Hackers can infiltrate systems to gain unauthorized access to personal information, potentially leading to unauthorized use or disclosure of data. Such access breaches the principles of purpose limitation and confidentiality outlined in POPIA.
- Ransomware Attacks: Ransomware attacks involve hackers encrypting an organization’s data and demanding a ransom for its release. If personal information is compromised in such an attack, organizations may face POPIA violations for failing to protect the integrity and security of personal data.
- Phishing and Social Engineering: Hackers often employ phishing techniques and social engineering tactics to deceive employees into revealing sensitive information or granting unauthorized access. Falling victim to these schemes can compromise personal data and contribute to POPIA non-compliance.
- Third-Party Security Incidents: Hackers can also target third-party vendors or service providers with access to an organization’s personal information. If these external entities suffer security breaches, it can lead to POPIA violations for both the vendor and the organization responsible for the data.
- Inadequate Security Measures: Hackers exploit weaknesses in an organization’s security infrastructure, such as outdated software, weak passwords, or lack of encryption protocols. Failure to implement robust security measures can leave personal data vulnerable to unauthorized access, potentially resulting in POPIA violations.
- Reputational Damage: A successful cyberattack can tarnish an organization’s reputation, leading to loss of customer trust and loyalty. Rebuilding trust after a security incident can be challenging, especially when POPIA violations are involved, as it demonstrates a failure to protect personal information adequately.
To mitigate these POPIA headaches caused by hackers, organizations must prioritize cybersecurity. Contact us today to assist your company with compliance and to protect your customers’ private information